Re: Cannot perform signing when multiple keys are present

Douglas,
That was it!!! I just uncommented the line "max_virtual_slots = 32;" and it
works as charm!!! Everything - signing with openssl, listing tokens &
objects by p11tool, the  pkcs11-tool -O -l. Everything just works!
Christmas is coming!

I would have never found it myself. I really don't know how to thank you!
Any wish? Of course, beer when you come to Gdansk/Poland is on me.

Thank you!
Marcin Okraszewski


On Tue, Dec 20, 2016 at 8:44 PM, Douglas E Engert <[email protected]>
wrote:

> The debug trace shows you have reach the default limits on readers and
> slots.
> You have all those drivers that define their own readers which most people
> don't have.
> I should have spotted that earlier.
>
> opensc.conf has default limits on how many readers and slots per reader.
> I think you have reached the limits, try changing them.
>
> see the opensc.conf file in app opensc-pkcs11 section.
>
>  # (max_virtual_slots/slots_per_card) limits the number of readers
>  # that can be used on the system. Default is then 16/4=4 readers.
>
> The libopensc can see the readers but the pkcs#11 can not see the slots.
>
>
> On 12/20/2016 8:08 AM, Marcin Okraszewski wrote:
>
>> Hi Douglas,
>> Thank you for your patience. I've tried with another Yubikey and now it
>> shows proper name in Device Manager, but the problem persists, so it is not
>> the root cause :( Further answers inline.
>>
>>         But I'm not able even to list tokens with p11tool. Note, I don't
>> specify any configuration. I just install OpenSC and run
>>         "gnutls-3.4.9\bin\p11tool.exe --provider
>> c:\Windows\System32\opensc-pkcs11.dll  --list-tokens". I run it as
>> administrator.
>>
>>
>>     I can not speak to how p11tool should work.
>>     Is there some 32 bit opensc-pkcs11.dll with 64 bit p11tool?
>>     You are running in a cmd window?
>>
>>
>> I install everything in 64bit version. I first install OpenSC 0.16. The
>> p11tool was mentioned here by David, as well as libp11 wiki
>> (https://github.com/OpenSC/libp11#using-the-engine-from-the-
>> command-line-tool <https://github.com/OpenSC/lib
>> p11#using-the-engine-from-the-command-line-tool>).
>>
>> Should I switch to 32bit?
>>
>>
>>     What does the OpenSC pkcs11-tool.exe -O -l show?
>>
>>
>> C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool.exe -O -l
>> No slot with a token was found.
>>
>> Output with OPENSC_DEBUG=9 is available here:
>> http://pastebin.com/3D9qfgDp
>>
>> The output of the PKCS11-Spy available here: http://pastebin.com/hJpyyhNG
>> . From what I see, it doesn't see the Yubikey in the PKCS11 Spy output,
>> while it is visible in debug output of the same command.
>>
>>
>>         When it comes to Device Manager, the card is not being recognized
>> even if I regenerate CHUID, unplug and plug token again or even reboot
>> Windows (2012 R2). The CHUID is being set and I can see the
>>         value being changed by status action.
>>
>>
>>     When you regenerated the CHUID, did it tell you what it did?
>>     There was a bug in in how Yubico created a CHUID It was fixed in
>> 2014. Are you using an old version?
>>     https://github.com/Yubico/yubico-piv-tool/issues/9 <
>> https://github.com/Yubico/yubico-piv-tool/issues/9>
>>
>>     I believe there is a verbose option for yubico-piv-tool to list the
>> chuid, or list it while it is created.
>>
>>
>> I'm using latest version, 1.4.2 from August 12, 2016.
>>
>> "yubico-piv-tool.exe -a set-chuid" returns "Successfully set new CHUID."
>>
>> Verbose output from set-chuid and status available here:
>> http://pastebin.com/x8gTtm43
>>
>> I have also found error entries in System Event log. It appears for all
>> readers (not only Yubikey) every time I use those PKCS#11 tools:
>>
>> Log Name:      System
>>
>> Source:        Microsoft-Windows-Smartcard-Server
>>
>> Date:          19.12.2016 14:57:48
>>
>> Description:
>>
>> Smart Card Reader 'Yubico Yubikey 4 OTP+U2F+CCID 0' rejected IOCTL
>> 0x313520: Incorrect function.  If this error persists, your smart card or
>> reader may not be functioning correctly.
>>
>>
>> Does it give any clue? I'm frankly completely lost!
>>
>> Thank you!
>> Marcin Okraszewski
>>
>>
>>
>>
> --
>
>  Douglas E. Engert  <[email protected]>
>
>

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel